Microsoft’s security team has urged Azure Container Instances (ACI) users to revoke any privileged credentials deployed to the platform prior to 31 August.
The advice comes as Palo Alto Networks discovered a vulnerability, which has since been fixed, within ACI which made it possible for hackers to obtain user data.
Dubbed Azurescape, due to the escape method being uncovered in Microsoft’s Azure container as a service (CaaS) platform, said a spokesperson for Palo Alto Networks.
“This type of cross-account takeover represents a new attack vector that hackers can use to target cloud services. We expect that more vulnerabilities will be discovered that enable cross-account takeover,” the spokesperson told IT Pro.
Azurescape was discovered by Unit 42 researcher Yuval Avrahami, who reported it to Microsoft and was awarded “two bug bounties” for an undisclosed amount.
No evidence was found suggesting that the flaw was exploited, according to the Microsoft Security Response Center team.
“There is no indication any customer data was accessed due to this vulnerability. Out of an abundance of caution, notifications were sent to customers potentially affected by the researcher activities, advising they revoke any privileged credential that were deployed to the platform before August 31, 2021,” they stated.
However, lack of evidence doesn’t exclude the chances that a data breach happened. Microsoft didn’t confirm whether it was confident no data had been accessed, according to Reuters.
The tech giant told ACI customers that if they hadn’t been notified, “no action is required”.
“If you are unsure whether your subscription or organisation has received a notification, please contact Azure Support. If you have any concerns, rotating privileged credentials is a good periodic security practice and would be an effective precautionary measure,” it added.
The advisory comes weeks after thousands of its Azure customers had their main databases compromised. Affected customers included some of the world's largest companies, according to cyber security researcher Wiz, and was dubbed “the worst cloud vulnerability you can imagine”.
Microsoft had since fixed the vulnerability, at the time saying that there was no evidence the flaw had been exploited. The tech giant had reportedly agreed to pay the security researchers $40,000 for finding the flaw and reporting it.
-
Third time lucky? Microsoft finally begins roll-out of controversial Recall featureNews The Windows Recall feature has been plagued by setbacks and backlash from security professionals
-
The UK government wants quantum technology out of the lab and in the hands of enterprisesNews The UK government has unveiled plans to invest £121 million in quantum computing projects in an effort to drive real-world applications and adoption rates.
-
Hackers are targeting Ivanti VPN users again – here’s what you need to knowNews Ivanti has re-patched a security flaw in its Connect Secure VPN appliances that's been exploited by a China-linked espionage group since at least the middle of March.
-
Broadcom issues urgent alert over three VMware zero-daysNews The firm says it has information to suggest all three are being exploited in the wild
-
Nakivo backup flaw still present on some systems months after firms’ ‘silent patch’, researchers claimNews Over 200 vulnerable Nakivo backup instances have been identified months after the firm silently patched a security flaw.
-
Everything you need to know about the Microsoft Power Pages vulnerabilityNews A severe Microsoft Power Pages vulnerability has been fixed after cyber criminals were found to have been exploiting unpatched systems in the wild.
-
Vulnerability management complexity is leaving enterprises at serious riskNews Fragmented data and siloed processes mean remediation is taking too long
-
A critical Ivanti flaw is being exploited in the wild – here’s what you need to knowNews Cyber criminals are actively exploiting a critical RCE flaw affecting Ivanti Connect Secure appliances
-
Researchers claim an AMD security flaw could let hackers access encrypted dataNews Using only a $10 test rig, researchers were able to pull off the badRAM attack
-
A journey to cyber resiliencewhitepaper DORA: Ushering in a new era of cyber security
